BudgetScan

Findings

Across all targets, most severe first.

Clear
SeverityTitleTargetFileTriage
critical Content-Length stream can consume bytes beyond the declared body length requestStream.Read swesweep-fasthttp streaming.go
VALID
critical Integer overflow in chunked Transfer-Encoding chunk size causes panic (remote DoS) readBodyChunked swesweep-fasthttp http.go
VALID
high Nil DialFunc returned when proxy setup fails FasthttpHTTPDialerTimeout swesweep-fasthttp fasthttpproxy/http.go
VALID
high Unbounded DoS via attacker-controlled 'seconds' parameter on profile and trace endpoints PprofHandler swesweep-fasthttp pprofhandler/pprof.go
VALID
high Infinite loop in readLine when no newline remains readLine swesweep-fasthttp headerscanner.go
VALID
high Unbounded per-IP counter map growth from retained zero-count entries perIPConnCounter.Unregister swesweep-fasthttp peripconn.go
VALID
high Unbounded gzip decompression in MultipartFormWithLimit(0) streaming path MultipartFormWithLimit swesweep-fasthttp http.go
VALID
high Decompression bomb via default no-limit BodyGunzip/BodyInflate/BodyUnbrotli/BodyUnzstd/BodyUncompressed BodyGunzip swesweep-fasthttp http.go
VALID
high Data race on caller-supplied dst buffer after request timeout clientGetURLDeadline swesweep-fasthttp client.go
VALID
high Unbounded brotli decompression can exhaust memory WriteUnbrotli swesweep-fasthttp brotli.go
VALID
high Unbounded decompression (decompression bomb) in WriteUnbrotli / AppendUnbrotliBytes WriteUnbrotli / AppendUnbrotliBytes swesweep-fasthttp brotli.go
VALID
medium Duplicate HTTP headers are collapsed instead of preserved ConvertRequest swesweep-fasthttp fasthttpadaptor/request.go
VALID
medium Uncontrolled regular expression compilation from r query argument getExpvarRegexp swesweep-fasthttp expvarhandler/expvar.go
VALID
medium Quadratic-time denial of service in path normalization normalizePath swesweep-fasthttp uri.go
VALID
medium LF-only header line separation creates parser differential readLine swesweep-fasthttp headerscanner.go
VALID
medium IPv6 and non-TCP remote addresses collapse to the same counter key 0 getConnIP4 swesweep-fasthttp peripconn.go
VALID
medium Decompression bomb: no output size limit in public decompression API WriteGunzip / WriteInflate / AppendGunzipBytes / AppendInflateBytes swesweep-fasthttp compress.go
VALID